Database
WordPress Vulnerability Database (page 1309)
Every known WordPress plugin, theme and core vulnerability with CVSS, affected and patched versions, CISA KEV status and public PoC signals.
The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.
- Medium6.1Cross-Site Scripting
Clockwork SMS Notfications
<2.4.2Update to 2.4.2
- High8.8Missing Authorization
Elementor Website Builder – more than just a page builder
≤1.7.12Update to 1.8.0
- Medium6.1Reflected Cross-Site Scripting
Contact Form 7 – Clockwork SMS
<2.4.1Update to 2.4.1
- High8.8Authenticated SQL Injection
inlinks
≤1.1No patch available
- Medium6.1Cross-Site Scripting
WP Customer Area
<7.4.3Update to 7.4.3
- Medium6.1Reflected Cross-Site Scripting
Yoast SEO – Advanced SEO with real-time guidance and built-in AI
≤5.7.1Update to 5.8.0
- Medium6.1Reflected Cross-Site Scripting
Emag Marketplace Connector
<1.0.1Update to 1.0.1
- Medium5.4Cross-Site Scripting
amtyThumb posts
≤8.2.0No patch available
- High8.8Authenticated PHP Object Injection
WooCommerce
<3.2.4Update to 3.2.4
- Medium6.4Stored Cross-Site Scripting
Affiliate Ads for Clickbank Products
≤1.6Update to 1.7
- High8.3Unauthenticated Stored Cross-Site Scripting
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Medium5.3Unauthenticated Information Disclosure
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
<2.05.03Update to 2.05.03
- Critical9.8Authentication Bypass
UserPro - Community and User Profile WordPress Plugin
<4.9.17.1Update to 4.9.17.1
- Medium6.1Cross-Site Scripting
Simple Membership
<3.5.7Update to 3.5.7
- Medium6.1Reflected Cross-Site Scripting
Ultimate Instagram Feed – WordPress Plugin
<1.3Update to 1.3
- Medium6.1Duplicator <= 1.2.28 – Unauthenticated Stored Cross-Site Scripting
Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More
≤1.2.28Update to 1.2.30
- Medium6.1Cross-Site Scripting
Content Cards
≤0.9.6Update to 0.9.7
- Medium6.1Cross-Site Scripting
Football Pool
<2.6.5Update to 2.6.5
- High8.8SQL Injection
JTRT Responsive Tables
<4.1.2Update to 4.1.2
- Critical9.8SQL Injection due to Double Prepare approach
WordPress
≤4.8.2Update to 3.7.23 or 3.8.23 or 3.9.21 or 4.0.20 or 4.1.20 or 4.2.17 or 4.3.13 or 4.4.12 or 4.5.11 or 4.6.8 or 4.7.7 or 4.8.3
- High8.8Authenticated Remote Code Execution
Shortcodes Ultimate – Content Elements
<5.0.1Update to 5.0.1
- Medium6.1Cross-Site Scripting
User Login History
<1.6Update to 1.6
- Critical9.8SQL Injection to PHP Object Injection
Contact Form for WordPress – Ultimate Form Builder Lite
<1.3.7Update to 1.3.7
- Medium6.1Cross-Site Scripting
Easy Appointments
<1.12.0Update to 1.12.0
- Medium6.1Reflected Cross-Site Scripting
External Media without Import
<1.0.0Update to 1.0.0
- Medium5.4Reflected Cross-Site Scripting
pootle button
≤1.1.1Update to 1.2.0
- Medium6.1Reflected Cross-Site Scripting
PopCash Code Integration Tool
<1.1Update to 1.1
- Medium6.1Authenticated Cross-Site Scripting
Max Mega Menu
≤2.3.8Update to 2.4
- High7.2Stored Cross-Site Scripting
Quards
all versionsNo patch available
- Medium6.1Reflected Cross-Site Scripting
My WP Translate
≤1.0.3Update to 1.0.4